A public cloud service provider provides cloud services such as storage and applications to general public. In a public cloud (or public datacenter), the service provider controls the hypervisor and may not provide robust or transparent security capabilities. It is, therefore, desirable to use a virtualization network provided by a third party (i.e., an entity other than the public cloud service provider) in a public cloud deployment. Such a cross-cloud virtualized network provides capabilities for enforcing network and security policies for workloads running on guest virtual machines (VMs) that are provisioned on a public cloud service provider's infrastructure and network. The third party created virtualized network can provide logical networking using overlays or simply integrate with native networking and provide services in addition to the services of the native network.
In an on-premise environment, customer applications running on guest VMs are managed by providing network and security services on the underlying hypervisor. However, in a public cloud environment, a third party network virtualization platform only has access to the guest VMs and not the underlying hypervisor on which the VMs are provisioned. In a public cloud, on the other hand, the service provider controls the underlying virtualization infrastructure on which guest VMs run. The virtualization infrastructure in the public cloud is not exposed to the end user.
The native networks that VMs use can be virtual networks provided by the cloud service provider. As a result, the logical networks that a third party virtualization network provisions sit on top of the cloud service provider's virtual networks and are not visible to the cloud service provider. When a VM is provisioned in the logical space of a third party created virtualization network, the VM's network interface becomes part of the logical address space that the third party network virtualization provider manages. The network interface is, therefore, not able to access the cloud service provider's native networks.